.webp)
Table of Contents
Nearly five years and two SEC chairs into the off-channel enforcement story, one thing hasn't moved: the recordkeeping rule that started it.
Enforcement has swung from the most aggressive sweep the industry had seen in years to a deliberate step back, through a change of administration, and now to a quieter test of the same standard, closer to home for the regulator. Through all of it, Exchange Act Rule 17a-4 and Advisers Act Rule 204-2 haven't changed.
2021–2025 Off-Channel Enforcement
The sweep landed in December 2021, when JPMorgan agreed to pay $125 million to the SEC - $200 million combined with the CFTC - for letting employees conduct business over WhatsApp without maintaining the records. The conduct in question reached back to January 2018. At the time, it read as a warning shot - one high-profile firm having an example made of them.
Over the next three years, the SEC brought a series of similar actions: sixteen firms in September 2022, eleven more in 2023, twenty-six firms in 2024, then a final wave of twelve more, totaling $63 million, in January 2025. Senvest Management became the first standalone private fund manager charged, in April 2024.
In total, the SEC collected $2.3 billion across 95 actions. Enough firms were impacted that the message alerted the whole market: unmonitored business chats were a recordkeeping failure, regardless of size or intent.
SEC Enforcement Priorities Shift Under a New Administration
In April 2025, sixteen firms appealed their fines, hoping for relief under new SEC Chair Paul Atkins. His appointment had been widely read as a signal of a lighter regulatory touch. The agency upheld them anyway, signaling that off-channel supervision wasn't being treated as a partisan issue.
Priorities shifted regardless. Through the first half of 2025, no new off-channel actions followed. The SEC's public enforcement focus moved toward fraud and investor harm cases, and the off-channel sweep that had dominated four years of headlines went quiet. Firms reasonably read this as reduced pressure.
That interpretation missed how the sweep itself had worked - nearly every wave of enforcement reached back years before it landed. JPMorgan's penalty covered conduct from three years before the fine. The 2022 wave also covered conduct from 2018. A firm going off-channel isn't avoiding today's scrutiny, it's setting the conduct period for whichever enforcement priority lands in the future.
FINRA's Off-Channel Enforcement in 2025 and 2026
The obligation didn't disappear with the SEC's attention. In June 2025, Velox Clearing was fined $1.3 million by FINRA and a further $500,000 by the SEC after a routine cycle exam found over 10,000 unretained WeChat messages that compliance had flagged internally but never actioned. A Wells Fargo broker was fined and suspended in October for sending off-channel texts, then for deleting them. A $65,000 fine against a member firm followed in November. By January 2026, FINRA had barred an individual from the industry over off-channel use.
The SEC's sweep mostly hit large institutions and made headlines. FINRA's enforcement runs through ordinary cycle exams and has increasingly held individuals personally accountable, not just firms.
Through the chairs, the administration change, and the shifting enforcement focus, one thing has stayed constant: the rule itself. Rule 17a-4 and Rule 204-2 require the same records in 2026 that they required in 2018, and state securities regulators retain independent authority to request them regardless of federal priorities.
The SEC's Own Recordkeeping Test
In July 2026, that same obligation showed up for the agency that enforces it. The SEC settled a two-year FOIA lawsuit tied to Coinbase, agreeing to produce its remaining withheld documents and cover $150,000 in the plaintiff's legal fees. The case had already forced the agency to disclose that text messages belonging to former Chair Gary Gensler, covering an eleven-month stretch in 2022 and 2023, had been deleted, and that 21 officials' phones had been wiped.
This isn't a story about the SEC's failings. It's a demonstration that the obligation to preserve records doesn't depend on who's subject to it. It applied to the banks fined in 2022, the broker barred in January, and, this time, the agency that wrote the rule. The obligation applies across the board.
Nearly five years of enforcement history point to one conclusion: regulatory attention moves in cycles. However, the off-channel obligation doesn't. Compliance postures should be built beyond current priorities, as the pendulum always swings back, and by then it's too late to catch up.
How MirrorWeb Can Help
MirrorWeb captures business communications across WhatsApp, iMessage, SMS, and other messaging channels, without requiring advisors to change how they work. Trusted Contacts lets advisors text clients from a single BYOD number, filtering out personal contacts and keeping those conversations private. This means that there’s no need to go off-channel in the first place.
Book a demo to ensure you remain examination-ready, regardless of who is in charge.
In July 2026, MirrorWeb & Red Oak combined to define a new standard in end-to-end compliance connectivity – Read the press release